Add an optional PENPOT_TRUSTED_ORIGINS setting listing alternate origins.
When a request Origin matches, the backend uses it as the public base for
links generated while serving that request: email links, asset URLs,
audit and webhook link fields, and redirects.
A global http middleware stamps the trusted origin on the request and
binds the config public-uri to it for the request extent. OIDC
authorization stores the origin in the signed state so the callback
(a navigation without Origin) can rebuild the token-exchange
redirect_uri and its redirect targets on the alternate domain.
Unlisted origins and requests without Origin are unchanged. Only
bare origins are supported, and server-to-server or queued work
keeps the canonical public-uri.
Closes#11625
AI-assisted-by: deepseek-v4.1-flash
60e8bf134a